• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2890
  • Last Modified:

ESE, MSExchangeIS, and VSS source errors in event viewer, cannot seems to trace or solve this!

Dear all, I am receiving three consecutive event ID errors on my Windows 2008 R2 Exchange 2010 server every day at around 8pm. I have been searching online for a solution for this, but have been unsuccessful in solving this for the past couple of months. At first I though it is something to do with my CA ArcServe r15.0 but the time this occur does not correspond with the time the backup is running. I am running the latest updates from MS.

Here are the event viewer events:
Log Name:      Application
Source:        ESE
Date:          4/24/2011 8:11:33 PM
Event ID:      2007
Task Category: ShadowCopy
Level:         Error
Keywords:      Classic
User:          N/A
Computer:     SRV02
Description:
Information Store (7008) Shadow copy instance 9 aborted.

For more information, click http://www.microsoft.com/contentredirect.asp.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESE" />
    <EventID Qualifiers="0">2007</EventID>
    <Level>2</Level>
    <Task>16</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-25T03:11:33.000000000Z" />
    <EventRecordID>449215</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SRV02</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Information Store</Data>
    <Data>7008</Data>
    <Data>
    </Data>
    <Data>9</Data>
  </EventData>
</Event>


Followed by:

Log Name:      Application
Source:        MSExchangeIS
Date:          4/24/2011 8:11:33 PM
Event ID:      9609
Task Category: Exchange VSS Writer
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SRV02
Description:
Exchange VSS Writer (instance a25099b4-ad8e-4b67-bc48-464d55a562c8:9) failed with error code -2147221233 when preparing for Snapshot.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeIS" />
    <EventID Qualifiers="49193">9609</EventID>
    <Level>2</Level>
    <Task>41</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-25T03:11:33.000000000Z" />
    <EventRecordID>449216</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SRV02</Computer>
    <Security />
  </System>
  <EventData>
    <Data>a25099b4-ad8e-4b67-bc48-464d55a562c8:9</Data>
    <Data>-2147221233</Data>
    <Binary>4356737349457863685772697465723A3A4F6E50726570617265536E617073686F743A204120636F6D706F6E656E74206265696E67206261636B6564207570206973206E6F74206F6E6C696E652E00</Binary>
  </EventData>
</Event>

Followed by:

Log Name:      Application
Source:        VSS
Date:          4/24/2011 8:11:33 PM
Event ID:      8229
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SRV02
Description:
A VSS writer has rejected an event with error 0x800423f3, The writer experienced a transient error.  If the backup process is retried,
the error may not reoccur.
. Changes that the writer made to the writer components while handling the event will not be available to the requester. Check the event log for related events from the application hosting the VSS writer.

Operation:
   PrepareForSnapshot Event

Context:
   Execution Context: Writer
   Writer Class Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}
   Writer Name: Microsoft Exchange Writer
   Writer Instance Name: Exchange Information Store
   Writer Instance ID: {4711c9d5-c1da-4e61-906a-77d9f3c527bc}
   Command Line: "D:\Program Files\Microsoft\Exchange Server\V14\bin\store.exe"
   Process ID: 7008
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8229</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-25T03:11:33.000000000Z" />
    <EventRecordID>449217</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SRV02</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x800423f3, The writer experienced a transient error.  If the backup process is retried,
the error may not reoccur.
</Data>
    <Data>

Operation:
   PrepareForSnapshot Event

Context:
   Execution Context: Writer
   Writer Class Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}
   Writer Name: Microsoft Exchange Writer
   Writer Instance Name: Exchange Information Store
   Writer Instance ID: {4711c9d5-c1da-4e61-906a-77d9f3c527bc}
   Command Line: "D:\Program Files\Microsoft\Exchange Server\V14\bin\store.exe"
   Process ID: 7008</Data>
    <Binary>2D20436F64653A20575254575254494330303030353239392D2043616C6C3A20575254575254494330303030323838392D205049443A202030303030373030382D205449443A202030303030373032302D20434D443A202022443A5C50726F6772616D2046696C65735C4D6963726F736F66745C45786368616E6765205365727665725C5631345C62696E5C73746F72652E6578652220202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary>
  </EventData>
</Event>


Any ideas?!

Thanks in advnace!
0
SpiderPig
Asked:
SpiderPig
  • 5
  • 2
1 Solution
 
Dejan ForoCommented:
Have you configured your file system antivirus exeptions. If not properly configured, file-system antivirus software can mess up with backup jobs. It can cause VSS get stuck , exchange log files not beeing flushed etc.

Apply the following:
Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows
http://support.microsoft.com/kb/822158/en-us 

File-Level Antivirus Scanning on Exchange 2010
http://technet.microsoft.com/en-us/library/bb332342.aspx


Restart Exchange Information Store service (this will dismount databases and make mailoboxes temporarily unavailable to users)

In command promt type vssadmin type writers . They should now be in good state.

If your machine is running as a virtual on hyper-V you might have a look at installing a hotfix described in Microsoft KB959962

Regards,

Dejan Foro
dejan.foro@exchangemaster.net
www.exchangemaster.net 
www.eugeurope.org 

0
 
SpiderPigAuthor Commented:
Good Info Dejan. I implemented changed. I will reboot servers tonight and monitor for the next 48 hours. I will keep you posted.

Cheers.
0
 
SpiderPigAuthor Commented:
No go Dejan. I got the same error again. I think I traced it to a MozyPro client running at the same time! I checked the client and VSS is enabled. I guess something there doesn't work well.
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 
SpiderPigAuthor Commented:
Any other ideas on this? I talked to Mozy support and not surprisingly they sent me to Microsoft... :(

Thanks.
0
 
Dejan ForoCommented:
Anything else running at the time? Antivirus check perhaps?
0
 
SpiderPigAuthor Commented:
Have ESET on it, but there are no scheduled scans.
0
 
SpiderPigAuthor Commented:
I switched AV from ESET to Panda seems to be working fine.

Thanks.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now